Memoryguard

• Outcome: Review
• Latest audit: Jul 22, 2026 · 7:48 AM UTC
• Version: 1.0.2

Overview

MemoryGuard is mostly a coherent local memory tool, but it also has persistent agent-configuration, local discovery, MCP process execution, and workspace file-changing powers that need review before installation.

Install only if you want a local memory system that can modify agent configs and store agent memories locally. Review the provider install changes first, keep .memoryguard out of shared repos if it may contain private memory or secrets, and avoid running discovery/apply features on untrusted workspaces or MCP configurations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (28)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

full_env = {**os.environ, **self.env}
        cmd = self.command + self.args
        try:
            self._proc = subprocess.Popen(
                cmd,
                stdin=subprocess.PIPE,
                stdout=subprocess.PIPE,

• Confidence: 93% confidence
• Finding: The client launches arbitrary executables taken from user-controlled MCP configuration files and inherits the current process environment, creating a direct code-execution boundary. Even though `shell=False` avoids shell injection, invoking untrusted MCP servers is still dangerous because discovery automatically executes them and then exchanges JSON-RPC messages with them.

Tainted flow: 'content' from pathlib.Path.read_text (line 403, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow

Content

src.unlink()
        elif patch.operation == "insert":
            content = src.read_text(encoding="utf-8")
            src.write_text(patch.diff.lstrip("+ ") + "\n" + content, encoding="utf-8")
        elif patch.operation == "replace":
            src.write_text(patch.diff, encoding="utf-8")
        changed_paths.append(patch.path)

• Confidence: 88% confidence
• Finding: The apply path writes attacker-controlled patch content to attacker-controlled file paths from a plan file without validating that the target stays inside the workspace. Because plan files are loaded from disk and patch.path is trusted, a crafted plan could overwrite arbitrary local files accessible to the user, making this more dangerous in a tool explicitly designed to modify files.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and configures capabilities that enable local code execution and broad data access (`python -m memoryguard.mcp_server`, local SQLite writes, provider installation, extraction from source files), but it does not declare permissions for those actions. This creates a trust and review gap: users or hosting platforms may approve the skill without understanding that it can read files, write files, invoke MCP tooling, and potentially reach the network or shell through its implementation and install flow.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The implementation contradicts its own stated security boundary by enumerating every hidden directory under the user's home directory rather than limiting discovery to explicitly authorized roots or fixed profile-declared paths. Even without reading file contents, this broad local inventory reveals installed tools, usage patterns, and potentially sensitive environment metadata, expanding surveillance scope beyond what a memory-governance backend needs.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: For a skill described as a local-first memory backend and governance console, broad home-directory discovery is over-privileged behavior that exceeds the apparent operational need of managing declared memory roots. This increases privacy risk and system reconnaissance capability, especially in agent environments where the user may not realize the tool is inventorying unrelated local applications.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: This GUI API exposes a full code-auditing and code-modification workflow, including plan generation, patch application, deletion, and rollback, even though the skill is described as a memory governance backend. That mismatch materially increases risk because any UI-exposed or JS-callable surface that can write arbitrary workspace files becomes a powerful local code-modification primitive if abused by a malicious page, compromised frontend logic, or unsafe surrounding integration.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill manifest and module purpose describe memory governance, but this code also performs direct workspace patching, file deletion, and backup restoration. In a security review, hidden or under-declared destructive capabilities are dangerous because operators may grant trust appropriate for a memory tool while unintentionally exposing a code-writing tool.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The UI repeatedly describes the neuron graph as a 'pure projection' and 'not the source of truth', but the same screen exposes actions such as accept/exclude/quarantine/supersede/merge/plan that call backend APIs and write DecisionEvents, generate new memory versions, and rebuild projections. In a governance console that manages shared memories across agents, this mismatch can mislead operators into believing they are performing safe visualization-only actions when they are actually mutating state, increasing the risk of unintended destructive or security-relevant changes.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module documentation asserts the client is read-only and does not invoke `tools/call`, but the class exposes a fully functional `call_tool()` method. This mismatch weakens security assumptions for reviewers and downstream callers, making it easier for future code paths to invoke active server-side actions under the false belief that the component is discovery-only.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This component reads MCP configs from agent directories and then spawns the referenced commands, which is a substantial execution capability beyond passive configuration inspection. In the context of a shared memory/governance tool, automatic execution of third-party MCP servers increases the attack surface and can trigger malicious local code merely by scanning for resources.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The tool advertises itself as read-only and 'No network, no writes,' but the implementation persists report.json and report.html to disk during audit. This violates the documented trust boundary and can surprise callers that invoke the tool in sensitive or sandboxed contexts expecting zero state changes, potentially causing unintended data persistence or policy bypass.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The code explicitly documents that `root_map` must be supplied to avoid guessing paths for external sources, but still falls back to `workspace / obj.relative_path` when `root_map` is absent. In a memory backend that ingests multi-root or external-agent data, this can cause source confusion: the system may read the wrong local file for a `SourceObject`, silently omit intended provenance boundaries, or normalize attacker-influenced paths against the workspace instead of the declared source root.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The method documentation promises a read-only, no-side-effects operation, but the implementation calls self.normalizer.save(ir), which persists data to disk. In a memory governance backend, callers may rely on the documented safety boundary when invoking scan/normalize in preview or audit contexts, so this mismatch can cause unintended state changes, persistence of sensitive data, and unsafe automation behavior.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module documentation promises default redaction of absolute paths for high-sensitivity objects, but `_render_invisible()` renders `item['path']` directly with only HTML escaping. In a local-first memory/governance tool, invisible or unreadable objects may include sensitive filesystem locations, so exporting them into a shareable offline HTML report can leak workstation structure, usernames, project locations, or secret-bearing path names.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The embedded AGENTS.md snippet is written entirely in Chinese and directs agent behavior without any user opt-in or equivalent-language alternative. This can materially change agent behavior in a way the installer may not understand, reducing informed consent and making it easier to hide operational constraints or redirections inside a foreign-language instruction block.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code enumerates hidden directories in the user's home directory with no evidence of an in-code consent, notice, or user-facing disclosure at the point of collection. Hidden-directory inventory can expose installed products and behavioral metadata, so performing it silently is a privacy and transparency problem even if file contents are not read.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The function persists discovery results into the workspace under .memoryguard/discovery/latest.json without any visible warning or minimization, creating a durable record of local environment reconnaissance. If the workspace is shared, synced, committed, or later accessed by other tools, this can leak host identifiers, detected products, and resolved paths beyond the original user context.

Missing User Warnings

High

• Confidence: 92% confidence
• Finding: When secret-like content is detected, the code persists the full sensitive content via append_record() and passes original_content to quarantine_memory(), meaning credentials may still be written to storage during handling. In a memory backend for multiple coding agents, this materially increases exposure because secrets can be retained, indexed, backed up, or later surfaced to other components despite being 'quarantined'.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code automatically synthesizes and stores derived memories from prior interactions without any visible approval or disclosure mechanism. In a shared multi-agent memory system, this can amplify privacy risk and propagate inaccurate or sensitive inferences that users never explicitly provided as standalone memories.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The import command persists conversation-derived records to disk automatically, but the user is not clearly warned that potentially sensitive chat content will be stored under .memoryguard/imports. In a memory-management tool handling agent conversations, silent persistence materially raises privacy and data-governance risk, especially on shared or synced workspaces.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The apply command deletes and rewrites files based on a plan file without an execution-time confirmation prompt for normal-risk plans. In a CLI that can modify arbitrary files, this weakens human-in-the-loop protection and makes accidental or malicious plan execution significantly more dangerous.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The undo command overwrites current files from backups without prompting the user. That can destroy legitimate newer changes or be abused if change metadata or backup references are tampered with, and the risk is elevated because this tool manages bulk workspace state.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: apply_plan performs backup, overwrite, and deletion operations directly from a plan file without any explicit confirmation parameter or backend-enforced user-approval check in this call path. Because the method is exposed through the GUI JS API, a caller that can invoke it may trigger destructive workspace changes once a plan exists, making accidental or unauthorized modification significantly more likely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: undo_change restores files from backups and overwrites current content without any explicit confirmation or safety interlock. This can cause loss of legitimate edits or be abused to revert files unexpectedly if the JS API is invoked by an untrusted or confused caller.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: ClaudeAdapter.install() and uninstall() directly create, modify, and delete instruction and MCP configuration files in the workspace or user config directory without any confirmation, dry-run, or trust boundary checks. In an agent skill context, this can silently alter another tool's behavior and persist changes beyond the current session, which is risky even if the feature is intentional.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/accept_v3_2.py:124

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: tests/test_v3_2_e2e.py:72